OPNsense Hardware Buying Guide 2026: From Home Office to HA Cluster

The question of the right OPNsense hardware is the most common entry point into our customer conversations at our offices in Neuburg an der Donau. It is also the question where the internet is full of blanket answers — from a 200 euro mini PC to a fully populated 1U server. Both can be right. It simply depends on the number of users, the bandwidth, the security features and the availability requirements at play.

This article is deliberately written as a buying guide, not a benchmark collection. We avoid invented throughput numbers and fixed prices — hardware pricing in 2026 fluctuates as never before, and any number without context is misleading. Instead we sort OPNsense hardware into four sizing classes, name the real bottlenecks and show where you can save sensibly and where you cannot.

Sizing classes at a glance: from home office to 1000 users

OPNsense runs on almost anything FreeBSD supports — but “runs” is not the same as “runs well”. In our projects we have used four practical classes for years.

Class 1 — Home office and micro office — 1 to 10 users

The classic use case: a sole trader, a three-person law firm, a branch office of a larger client. Internet typically 250 to 1000 Mbit/s fibre, one or two VLANs, WireGuard for site connectivity, optionally CrowdSec or simple blocklists.

Hardware needs here are deliberately slim: a fanless x86 mini PC with four to six 2.5 GbE ports, 8 GB RAM, a 128 GB NVMe. AES-NI is standard today but still worth checking — OPNsense would noticeably lose WireGuard throughput without it. Suricata IDS is possible in this class but only with a curated rule selection. Enabling ET Open unfiltered will drive the CPU straight into the wall.

For this class standard consumer silicon usually works. What matters more is NIC quality: Intel i225 or i226 are effectively mandatory, Realtek only if there is really no alternative. We cover this segment in more depth in our guide on replacing a FRITZ!Box with OPNsense.

Class 2 — Standard office — 25 to 50 users

A trade business with 40 employees, a tax office, a mid-sized engineering practice. Two to four VLANs, common cloud services, backups to an in-house TrueNAS, roadwarrior VPN for field staff. Suricata with selected categories, DNS blocklists via Unbound.

Here we move from consumer to small server territory. A short-depth 1U with four to six 2.5 GbE ports plus two 10 GbE SFP+ is the sweet-spot configuration. 16 GB RAM, a small NVMe for OS and logs, redundant PSUs are nice to have. CPUs in the range of a modern Intel Atom C series or Xeon-D are sufficient, provided Suricata is used with judgement.

This class is also the first where a proper coldspare makes sense — an identical second appliance in the cabinet, unconfigured until the incident. Restore time from a saved configuration is well under an hour if the documentation is solid.

Class 3 — Multi-site and mid-market — 100 to 250 users

A manufacturing company with administration and workshop, a hotel group with three properties, a regional retailer with four branches. Class 2 devices reach their limits here: 10 GbE uplinks become the norm, Suricata runs permanently, HAProxy publishes internal services outward, CrowdSec and GeoIP filter actively.

For this class we recommend 1U systems with eight to twelve 10 GbE SFP+, 32 to 64 GB RAM, mirrored NVMe, redundant PSUs and out-of-band management via IPMI or Redfish. The CPU choice is often Xeon-D-2700 or AMD EPYC embedded — enough cores for multi-thread Suricata, acceptable power draw, good long-term availability.

From this class onward HA via CARP is no longer a luxury but the rule. Two identical appliances, XMLRPC sync, config sync over pfsync — and a properly tested failover procedure that we document for every customer. On the pitfalls we have written separately in OPNsense CARP HA — the usual pitfalls.

Class 4 — Large mid-market and data centre — 500 to 1000+ users

A hospital group, a mid-sized industrial company, an administrative site with several hundred endpoints. Symmetric gigabit or 10 GbE uplinks, multiple peering paths, IDS with the full ruleset, extensive segmentation, often several HA clusters per zone.

In this class we use 1U or 2U servers with 25 GbE SFP28 or 40 GbE QSFP+ ports, 64 to 128 GB RAM, redundant PSUs and dedicated management ports. For uplinks we prefer Mellanox ConnectX or Intel E810 — both are stable under FreeBSD, well maintained on the driver side and bring hardware offloads that show up clearly in Suricata setups.

An important note: in class 4 throughput is no longer determined by the CPU alone but by the combination of NIC offload, IDS rule count and multi-queue configuration. We do not size such systems “on paper” but on the basis of a test run with real customer traffic.

Network ports: 2.5 GbE, 10 GbE, 25 GbE or 40 GbE?

Port choice rarely follows raw bandwidth — it follows the connectivity chain. A 10 GbE uplink is pointless if the backbone switch only delivers SFP+ with 8 Gbit/s effective throughput. Conversely, a site with 500 Mbit/s internet but a large internal storage network may legitimately need 25 GbE between the firewall and the core switch.

As a rough map we use:

• 2.5 GbE copper: home office, micro office, VLAN uplinks in class 2
• 10 GbE SFP+: standard uplink for class 2 and 3, WAN uplink on symmetric gigabit lines with headroom
• 25 GbE SFP28: class 3 with heavy internal segmentation, class 4 as default
• 40 GbE QSFP+: primarily class 4, usually as a trunk between the firewall cluster and the core switch

40 GbE in 2026 is no longer a prestige feature but a legitimate option when an existing data centre network is already based on 40 or 100 GbE. Conversely, we advise against planning 40 GbE just because the ports appear on the datasheet — optics are more expensive, failure modes differ, and the benefit without a matching counterpart is zero. More detailed thoughts on the 10-versus-100 GbE question can be found in 100 GbE is the new 10 GbE.

IDS throughput: why Suricata dominates the sizing

The most common sizing mistake with OPNsense hardware is a CPU dimensioned for pure routing that collapses once Suricata is active. As a rule of thumb: active IDS with a mid-sized ruleset roughly halves the usable throughput compared with routing-only. With ET Pro and a full category selection the reduction can be even larger.

Precise numbers on this circulate widely but are useless without the ruleset, traffic mix and test methodology. Our approach: we always plan the CPU with a reserve of two to three cores for Suricata, configure multiple threads with matching queue assignments — and monitor CPU headroom via the built-in Insight reports in operation.

For the rule selection itself we have described the approach in OPNsense Suricata: rule tuning without false-positive floods.

Coldspare, warmspare or true HA?

The third major decision after sizing and ports is the availability strategy. In customer projects we see three sensible variants — anything beyond is rarely used in practice.

Coldspare — an identical, unconfigured second appliance in the cabinet. Restore from the config backup in a typical 30 to 60 minutes. For class 1 and many class 2 customers this is entirely sufficient if a one-hour outage is tolerable. Prerequisite: a reliable, daily configuration backup and a documented restore procedure.

Warmspare — a second appliance pre-configured but idle. Switch recabling or VLAN reassignment in the incident. Sensible in class 2 and 3 environments where HA is difficult for layer 2 reasons — for example certain provider handover setups.

HA with CARP — two active appliances, virtual IPs, automatic failover within seconds. Standard for classes 3 and 4, increasingly common in class 2 as well. Requires a network that supports CARP cleanly — redundant switches, sound VLAN design, sound provider connectivity.

An honest word: HA does not only double the hardware cost, it also doubles the maintenance surface. Anyone without dedicated processes for firmware updates in the cluster creates more risk with CARP than they solve.

Procurement: prebuilt appliance, custom build or Deciso?

In 2026 you can source OPNsense hardware from three channels: the Deciso factory appliance range, specialised appliance vendors and custom builds on 1U servers. All three are legitimate; they differ in support, delivery time and price bracket.

In classes 1 and 2 we often use prebuilt appliances, in classes 3 and 4 increasingly customer-specific 1U systems. The advantage: targeted NIC selection, defined spare parts availability, documented firmware baselines. The downside: higher initial investment and longer delivery times.

Deciso appliances offer the benefit of direct vendor coupling with the distribution — occasionally valuable when a firmware update regression occurs. Price ranges and availability are best discussed individually; fixed numbers change too fast to name meaningfully in an article.

For a concrete quote please reach out via our OPNsense service page — we size the right class together with you, based on your real network structure, not on marketing datasheets.

What you should not buy

A paragraph from practical experience. Certain hardware classes are proposed as an OPNsense base again and again and in practice do not deliver: repurposed consumer routers running BSD firmware, ARM systems beyond the officially supported platforms, very old Xeon E5 servers with high power draw and no AES-NI acceleration. On the topic of server recycling we have written separately in Scrap bounty for old servers — the equation rarely favours the old iron.

We remain equally sceptical about combination devices that market firewall, access point and switch as one box. For real SMB environments with segmentation requirements, a dedicated firewall remains the better path.

FAQ

How much RAM does an OPNsense appliance need at minimum?

For class 1, 8 GB is sufficient; class 2 should be planned with 16 GB, class 3 with 32 to 64 GB, class 4 with 64 to 128 GB. Suricata and Zenarmor are the largest RAM consumers; anyone enabling both should size at the upper end of the class.

Are 2.5 GbE ports enough for gigabit fibre?

Yes, in class 1 and in many class 2 environments. As soon as 10 GbE is required internally between firewall and core switch — for NAS traffic for example — there is no way past SFP+ ports.

Are Intel NICs mandatory or does Realtek work too?

Intel i225/i226 for 2.5 GbE and Intel X710/E810 or Mellanox ConnectX for 10/25 GbE are our standard recommendation. Realtek works in small setups but produces more edge cases under FreeBSD that are hard to diagnose. For production environments we stick with the Intel or Mellanox path.

Are the M50 or M60 still appropriate for OPNsense environments?

No — the TrueNAS M series models M50 and M60 were declared end of life in late 2025. For new storage purchases around an OPNsense environment the current M-series models M30 and M40 are the right choice, configurable via our TrueNAS configurator.

When does HA make sense over a coldspare?

As soon as an outage of 30 to 60 minutes becomes business critical — for example on ecommerce connectivity, VoIP PBXs, emergency response systems or production lines with network coupling. Below that threshold a well-run coldspare is often the more economical solution.

Can I upgrade my existing OPNsense hardware over time?

Within limits, yes. RAM upgrades and additional storage are usually unproblematic. Changing the network speed — for example from 10 to 25 GbE — almost always requires a new platform. That is why we plan this dimension with a two to three year lead time on every procurement.